A recently identified data stealer is using Telegram to exfiltrate information harvested from infected machines, Juniper Networks security researchers say.
Marketed on underground forums as “Masad Clipper and Stealer,” the malware targets browser data, in an attempt to collect from there usernames, passwords and credit card information. Additionally, the threat can replace cryptocurrency wallet addresses on the clipboard with its own.
Written using AutoIt scripts and compiled into a Windows executable, Masad Stealer’s binary is only 1.5 MB in size. However, it can also be found bundled into other software, the researchers say.
When executed, the malware drops itself in %APPDATA%folder_name}{file_name}. For persistence, it creates a scheduled task to start itself every minute.
Next, Masad Stealer starts collecting sensitive information from the system, including cryptocurrency wallet data, PC and system information, credit card data and passwords from browsers, installed software and processes, desktop files, browser cookies, Steam files, AutoFill browser fields, Discord and Telegram data, and FileZilla files, and also takes a screenshot of the desktop.
The information is archived using 7zip, which is bundled into the malware binary. The ZIP file is sent to the command and control (C&C) server using a hardcoded bot token, via the sendDocument Telegram bot API, Juniper Networks says.
When establishing communication between the C&C and the bot, a getMe message using the bot token is sent, to which the bot responds with the user object containing the username of the bot. With multiple actors using this malware, the username object is useful for identification purposes.
Masad Stealer can replace crypto-wallets on the clipboard with attacker-specified wallets, if they match particular configuration. The threat targets Monero, Bitcoin Cash, Litecoin, Neo, Web Money, ADA, ZCASH, DogeCoin, Stratis, QIWI Pay, Bicond, Waves, Reddcoin, Qtum, Payeer, Bytecoin, Bitcoin, Black Coin, VIA, Steam Trade Link, Bitcoin Gold, Emercoin, Lisk, Ethereum, Dash, Ripple, and Yandex Money.
The stealer is being distributed masquerading as a legitimate tool and bundled into third party tools. The applications are then advertised on forums, third party download sites, or file sharing sites. In some cases, Masad Stealer can download additional malware, usually a miner.
Masad Stealer is being advertised on hack forums starting at free, with its price going up to $85, depending on the selected tier and the features the buyer is looking to receive. The researchers also discovered a dedicated website that promotes the malicious program.
The malware authors also created a Telegram group that potential clients can join, and where they might also be offering tech support to them. At the moment, the group has more than 300 members.
To date, over 1,000 Masad Stealer samples have been identified, as well as 338 unique Telegram C&C bot IDs.
Related: New Variant of HawkEye Stealer Emerges
Related: Baldr Stealer Malware Active in the Wild With Ongoing Updates